CVE-2020-3865: About the security content of iCloud for Windows 10.9.2

Released January 29, 2020

ImageIO

Available for: Windows 10 and later via the Microsoft Store

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3826: Samuel Groß of Google Project Zero

libxml2

Available for: Windows 10 and later via the Microsoft Store

Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution

Description: A buffer overflow was addressed with improved size validation.

CVE-2020-3846: Ranier Vilela

WebKit

Available for: Windows 10 and later via the Microsoft Store

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue was addressed with improved state management.

CVE-2020-3867: an anonymous researcher

WebKit

Available for: Windows 10 and later via the Microsoft Store

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2020-3825: Przemysław Sporysz of Euvic

CVE-2020-3868: Marcin Towalski of Cisco Talos

WebKit

Available for: Windows 10 and later via the Microsoft Store

Impact: A malicious website may be able to cause a denial of service

Description: A denial of service issue was addressed with improved memory handling.

CVE-2020-3862: Srikanth Gatta of Google Chrome

WebKit

Available for: Windows 10 and later via the Microsoft Store

Impact: Visiting a maliciously crafted website may reveal the sites a user has visited

Description: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin.

CVE-2019-8827: Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum, and Roberto Clapis of Google Security Team

Entry added February 3, 2020

WebKit Page Loading

Available for: Windows 10 and later via the Microsoft Store

Impact: A top-level DOM object context may have incorrectly been considered secure

Description: A logic issue was addressed with improved validation.

CVE-2020-3865: Ryan Pickren (ryanpickren.com)

Entry added February 11, 2020

WebKit Page Loading

Available for: Windows 10 and later via the Microsoft Store

Impact: A DOM object context may not have had a unique security origin

Description: A logic issue was addressed with improved validation.

CVE-2020-3864: Ryan Pickren (ryanpickren.com)

Entry added February 11, 2020